Examining best practices for ATM security

With crime rising nationwide, ATM operators need to be vigilant to protect their assets. At the same time, new Payment Card Industry standards require operators to update their payment equipment to prevent fraudulent transactions. These were just some of the issues confronting today's ATM industry explored during a session, "Best Practices for Securing Your ATM Equipment and Funds," at the recent Amusement Expo International show at the Westgate Hotel in Las Vegas.

The session, moderated by Bret Clostermery, president and owner of Modern Gaming Co. LLC in Madison, Wisconsin, began with an overview of the insurance coverages needed for ATMs.

Panelist Phil Webb, president of PDQ Merchant Enterprises Inc., a McHenry, Illinois-based ATM operator, said building insurance will cover cash in the building and in the safe.

Liability insurance will cover loss if an ATM is robbed or if cash is lost in transit. During COVID, Webb updated his liability policy to cover the cash threshold in each specific location. "On a monthly basis we update that list," he said.

It is also important to read the fine print in the policies, Webb said. An insurance company may require an ATM to be bolted to the floor or have surveillance cameras and alarms to cover it.

"You need to let your insurance company know how much money is going to be in the ATM," said panelist Michael Guthrie, vice president of sales at Spokane, Washington-based Cypress Advantage, which operates ATMs along the West Coast. Some ATMs in cannabis-related locations go through $50,000 to $75,000 per week, he said.

Liability insurance will also cover losses from someone getting hurt by an ATM.

"You have to secure yourself for any kind of lawsuit that could come your way," said Guthrie. He cited an instance where an ATM fell on a security guard who was pushing the machine back and forth.

Panelist Mark Cumming, owner of ATM Merchant Services, a Friendswood, Texas-based ATM provider, said he uses bolts in his ATMs that drive into the cement. The company uses TPI washers and TPI indoor and outdoor sleeves that go on the outside of the machine to provide extra security for the ATM. He recommended using half-inch bolts and driving them a minimum four inches deep in the ground.

"When we go into a new location, we're looking for alarm systems, we're looking for motion detectors," Cumming said. In some locations, he covers the cost of security around the ATM, while in others, the location covers the cost.

Cash reconciliation

On the topic of reconciling cash in the machine, the panelists agreed it is important to reconcile cash on a daily basis. They shared some stories about losing money from failing to reconcile the cash.

Webb said there is cash in the bank, cash in the safe, cash in the ATM and cash in the vehicles that need to be reconciled as part of a cash reconciliation report.

"If you're not reconciling on a regular basis your own ATMs you're doing yourself a huge disservice," Guthrie said.

"We do day reports every time we're out at an ATM," agreed Cumming, who requires route drivers to turn in their receipts daily. "It does throw our balances off because we're doing day reports, but we have cradle-to-grave tracking of all of our money. Mistakes happen.

"Make sure you're doing your reports if you're doing cash loading for other people … because the less information they give you it makes it harder for you to reconcile," he said. "If I'm going to cash load for Mike, I would require copies of the settlement setup reports before I put my money in a machine. It's not that I don't trust Mike (Guthrie), but it's my money."

"We require documentation for everything we do," Guthrie said with regards to ATM-related deposits. "We require the documentation so that everybody's protected."

PCI compliance

Panelist Jonathan Dunn, a service technician at Venco Business Solutions Inc. based in Bland, Virginia, offered a status report on PCI keypad compliance.

Dunn passed out a summary that noted the PCI standards help ensure that data is transferred securely though the ATM ecosystem.

He said Jan. 1, 2025 is the credit card networks' deadline for phase 3 "key blocks."

(Key blocks protect the secrecy integrity of an encrypted key, according to a document provided by Geobridge, an Ashburn, Virginia-based company that supports encryption, cryptography and payment applications to payment processors, issuers, terminal manufacturers and merchants.)

Failure to implement phase 3 (TR-31) key blocks can leave an ATM vulnerable to hacker attacks and compromise customer payment data, according to Venco Business Solutions.

The ATM networks (Visa and Mastercard) will be able to assess penalties on the independent sales organization, the company that acts as an intermediary between merchants and the acquiring banks that accept the payment from credit card transactions, and force non-compliant ATMs to shut down.

ATMs will require a software update prior to Jan. 1, 2025 and may, based on the age of the software, require ATM replacement or replacement of the electronic PIN pad.

Equipment supply chain issues

Upgrading payment equipment is complicated to some extent by supply chain issues, the panelists agreed.

"Do I want to upgrade, or do I want to throw it away?'" Webb said posing a question to his listeners. As an operator, he said he would start upgrading 10% of his ATMs every month.

"There are some supplies, but you need brackets, and sometimes they have brackets but they don't have wiring; sometimes they have harnesses but they don't have keypads … you're going to need the bracket, the keypad and the harness," he said. "It's going to be a challenge … do it as often and early as possible so you're not caught behind the eight ball."